How to Secure Mobile Apps Across the Ecosystem

TL;DR

Mobile application security requires protecting the entire ecosystem, including native software, operating systems, network connections, and back-end servers. Existing web security practices still protect reused server infrastructure, but mobile development introduces added concerns such as locally persisted data, client-side SQL injection, complex permission models, application interaction, and uncertainty about who is accountable for security failures.

Transcript

Thank you very much. I'm really happy to be here with you guys today and to share a little bit about, uh, software security and, in particular, software security as it affects mobile applications. I'll be doing a full-length version of this talk at RSA Conference this year, but I'm really excited to be giving this, uh, abridged version here today. ... Read More

Key Insights

• Smartphone adoption increases the importance of mobile security because these devices function as pocket computers. Morgan Stanley projections cited in the talk anticipated smartphone sales surpassing feature-phone sales in North America and worldwide smartphone shipments surpassing total PC shipments.
• Mobile commerce creates a direct business reason to improve security. Google research cited in the talk found that 29 percent of United States smartphone users and 45 percent of Japanese smartphone users had made purchases using their phones.
• Smartphone purchases are not limited to inexpensive applications. Mobile users who purchased through their phones spent an average of $300 on categories including entertainment, electronics, clothing, travel, wireless service, and other communication services.
• Perceived insecurity can prevent mobile transactions. In a Google study of more than 5,000 smartphone users, feeling that mobile purchasing was unsafe was identified as the second-ranked reason among people who had not completed a purchase.
• Mobile security is an ecosystem problem involving the native application, operating system, network connection, service provider, back-end server, and interactions with other user software. Effective protection must therefore extend beyond code running directly on the phone.
• Existing web security work remains valuable because many mobile applications connect to established server applications through new web service entry points. Previous secure development lifecycle work and protections for operational infrastructure and running server applications continue to apply.
• Client-side persistence supports interrupted or unreliable connectivity by allowing mobile applications to store, cache, and retrieve information locally. This capability can also expose the client to attack classes that were traditionally associated with servers, including client-side SQL injection.
• Mobile operating systems provide built-in protections such as read-only stacks, data-encryption facilities, strong communication mechanisms, and application permission models. These features can support secure deployment, but unfamiliar, complicated, or poorly documented models can create challenges for developers.

Questions & Answers

Q: Why is mobile application security important to businesses?

Mobile application security matters because smartphones increasingly connect consumers directly with suppliers, e-commerce systems, and service providers. The cited Google research found that 29 percent of United States smartphone users and 45 percent of Japanese smartphone users had purchased through a phone. Users who made purchases spent an average of $300, while perceived insecurity remained a major barrier for those who had not purchased.

Q: What components are included in the mobile security ecosystem?

The mobile security ecosystem includes the native application, the phone, the mobile operating system, other user software, the network connection, the network service provider, and the back-end server. The server commonly performs most business logic, processing, and data storage. Because these components depend on one another, securing only the visible application does not address the complete system described in the talk.

Q: How do existing web security practices help protect mobile apps?

Existing web security practices remain useful because many enterprises extend long-running web applications with additional web service entry points for native iOS and Android applications. The same back-end infrastructure may continue supplying processing and data. Work already applied to the server, including its secure development lifecycle, operational protections, and defenses for the running application, therefore continues to support the mobile service.

Q: Why do mobile applications store data on the device?

Mobile applications store, cache, and retrieve data locally to handle connectivity problems. If a network connection drops during a transaction, local persistence can help prevent the user from losing the entire transaction and starting again. The mobile operating system often provides this storage capability. However, moving data processing and persistence onto the client also creates additional security exposure that developers must consider.

Q: What security risk does client-side persistence introduce?

Client-side persistence can expose mobile applications to attacks that were traditionally concentrated on servers. The talk specifically identifies client-side SQL injection as a real concern when mobile operating systems and applications use local data storage. The feature is operationally useful for caching information during unreliable connectivity, but its locally processed data must be treated as part of the application's attack surface.

Q: What security features are built into mobile operating systems?

Mobile operating systems described in the talk include protections such as a read-only stack, built-in data-encryption facilities, strong communication models, and permission models governing how applications communicate. These features reflect lessons from earlier operating-system security problems and the narrower use cases of mobile devices. They can help developers build and deploy applications securely, although developers still need to understand how the mechanisms work.

Q: Why can mobile permission models be difficult for developers?

Mobile permission models introduce new concepts that developers must learn, even though they are intended to strengthen application security. The talk describes the Android permission model as complicated and poorly documented, based on research by the HP Fortify team. Confusion about permissions and communication between applications can make secure implementation difficult, so built-in operating-system protections do not eliminate the need for careful development.

Q: How does consumer trust affect mobile commerce revenue?

Consumer trust affects revenue because some smartphone users want to make purchases but avoid doing so when the process does not feel secure. In the cited study of more than 5,000 smartphone users, perceived insecurity was the second-ranked reason for not purchasing. Service providers can therefore view stronger application and ecosystem security as a way to remove a barrier blocking customers from using the mobile transaction channel.

Summary & Key Takeaways

• Smartphones were becoming central computing and commerce platforms, making their security increasingly important to consumers and service providers. Morgan Stanley projections anticipated smartphones surpassing feature phones in North American sales and PCs in worldwide shipments, while Google research showed substantial purchasing activity and identified perceived insecurity as a major barrier to further mobile transactions.

• Mobile security covers an interconnected ecosystem rather than a single application. A native app depends on its mobile operating system, other user software, a network provider, and a back-end server that commonly handles most business logic, processing, and data storage. A weakness in any participating component can affect the service relationship.

• Many mobile services extend established web applications through additional web service entry points. Consequently, investments in server security, secure development practices, operational protection, and running-application defenses remain useful. Mobile software also adds distinct challenges, including offline data persistence, client-side injection risks, unfamiliar operating-system features, complicated permissions, and communication between applications.